diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 0b1355a..8666b66 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -11,7 +11,7 @@ env:
 jobs:
   build:
     name: Build ${{ matrix.target }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.runs_on }}
     strategy:
       fail-fast: false
       matrix:
@@ -20,11 +20,19 @@ jobs:
           - target: x86_64-unknown-linux-gnu
             artifact_name: swcli-linux-gnu-x86_64
             use_cross: false
+            runs_on: ubuntu-latest
 
           # Alpine / musl — fully static binary
           - target: x86_64-unknown-linux-musl
             artifact_name: swcli-linux-musl-x86_64
             use_cross: true
+            runs_on: ubuntu-latest
+
+          # macOS Apple Silicon
+          - target: aarch64-apple-darwin
+            artifact_name: swcli-macos-arm64
+            use_cross: false
+            runs_on: macos-latest
 
     steps:
       - uses: actions/checkout@v6
diff --git a/Cargo.lock b/Cargo.lock
index e2f82ac..d80bdd9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -898,9 +898,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.9"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "ring",
  "rustls-pki-types",